{"id":"CVE-2026-86589","kind":"vulnerability","aliases":["CVE-2026-86589"],"related":[],"title":"Apache Answer: external login sessions skip suspension checks after account deletion","description":"Incorrect implementation of authentication algorithm vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nA flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session\n  expires or is revoked.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","summary":"A flaw in the User Center login integration creates sessions that omit the external identity, so later requests skip central account suspension or deletion checks. An attacker whose external account was suspended or deleted can keep using the Apache Answer session until it expires or is revoked.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-answer","runtime","self-hosted","user-center-login"],"not_affected_if":["local-accounts-only","patched-2.0.3"],"how_to_check":"- Check the installed Apache Answer version and whether it is `2.0.2` or earlier\n- Confirm whether User Center (external login) integration is enabled in the deployment\n- unknown for other checks, as the sources do not say","fix":"- Upgrade Apache Answer to `2.0.3`\n- Revoke existing sessions for users whose external accounts were suspended or deleted, as the sources do not say more","status":"open","published_at":"2026-10-19T10:16:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:11:00+00:00","updated_at":"2026-10-25T05:11:00+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:11:00Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Answer to `2.0.3`\n- Revoke existing sessions for users whose external accounts were suspended or deleted, as the sources do not say more","reach":"internet","title":"Apache Answer: external login sessions skip suspension checks after account deletion","impact":"medium","summary":"A flaw in the User Center login integration creates sessions that omit the external identity, so later requests skip central account suspension or deletion checks. An attacker whose external account was suspended or deleted can keep using the Apache Answer session until it expires or is revoked.","category":"runtime","nicknames":[],"who_cares":["apache-answer","self-hosted","user-center-login"],"confidence":0.6,"needs_auth":"yes","worst_case":"suspended external user keeps access to the account session","analyst_note":"Confirm from the Apache Answer 2.0.3 release notes or advisory whether the User Center integration is the only affected path and whether existing sessions need revocation.","how_to_check":"- Check the installed Apache Answer version and whether it is `2.0.2` or earlier\n- Confirm whether User Center (external login) integration is enabled in the deployment\n- unknown for other checks, as the sources do not say","needs_analyst":true,"not_affected_if":["local-accounts-only","patched-2.0.3"],"who_is_affected":"Deployments of Apache Answer through 2.0.2 that use the User Center login integration for external users. Sites that sign users in only with local accounts are not described as affected. Teams using the fixed `2.0.3` release can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3347,"output_tokens":571,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-86589':14A,17A '2.0.2':91C '2.0.3':138C 'account':10A,49B,58B,119C 'affect':87C 'algorithm':80C 'allow':113C 'answer':2A,20B,68B,84C,89C 'apach':1A,19B,67B,83C,88C 'apache-answ':18B 'attack':55B 'authent':79C 'bypass':117C 'caus':101C 'center':27B,34B,97C 'central':48B,118C 'check':8A,53B,123C 'creat':37B,104C 'cve':12A,15A 'delet':11A,52B,62B,122C 'expir':72B,127C 'extern':3A,42B,57B,105C,111C 'fix':140C 'flaw':30B,93C 'host':24B 'ident':43B,112C 'implement':77C 'incorrect':76C 'integr':36B,99C 'issu':86C,142C 'keep':64B 'later':45B 'login':4A,28B,35B,98C 'newli':103C 'omit':40B,109C 'recommend':133C 'request':46B,115C 'revok':75B,130C 'runtim':21B 'self':23B 'self-host':22B 'session':5A,38B,69B,107C,126C 'skip':6A,47B 'subsequ':114C 'suspend':60B 'suspens':7A,50B,120C 'upgrad':135C 'use':65B 'user':26B,33B,96C,106C,131C 'user-center-login':25B 'version':137C 'vulner':81C 'whose':56B","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache Answer through 2.0.2 that use the User Center login integration for external users. Sites that sign users in only with local accounts are not described as affected. Teams using the fixed `2.0.3` release can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-86589","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86589","severity":null,"published_at":"2026-10-19T10:16:49+00:00","modified_at":"2026-10-19T20:47:17+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}